Privacy implications of Monero (XMR) watch-only credentials

Security About seeds and wallet
, ,
1

When creating a wallet with Trezor in the Monero GUI, you have to export “watch only credentials” which are then stored to disk, encrypted with a password.

I would like to know what are the privacy implications are if those watch-only credentials are stolen/breached. Would the attacker be able to see my transactions and balance on all chains where I have wallets created from the same seed? Or would the attacker only be able to see my Monero balance and transactions?

3

Generally speaking, the keys that Trezor uses are scoped. Getting ahold of keys for one coin tells you nothing about keys used for different coins. Even if a private key for your Monero was leaked, an attacker can’t use this private key to access any of your other coins.

That implies the answer to your question: if an attacker gets your watch-only credentials, they get to watch your Monero account, but they cannot learn anything about other coins.

2 Likes